ci: add Forgejo CI/CD pipeline with docker save/load deploy to prod

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
refactor: move bot tokens to .env, remove hardcoded credentials
2026-06-30 18:55:21 +00:00 · 2026-06-30 18:15:44 +00:00
7 changed files with 135 additions and 25 deletions
--- a/.env
+++ b/.env
@ -1,5 +0,0 @@
-# Docker Compose Project Name
-COMPOSE_PROJECT_NAME=lichess
-
-# Примечание: Другие переменные окружения хранятся в конфигах сервисов
-# Telegram Bot Token: LichessClientTG_bot/config.py
--- a/.env.example
+++ b/.env.example
@ -0,0 +1,6 @@
+# Docker Compose Project Name
+COMPOSE_PROJECT_NAME=lichess
+
+# Telegram Bot Tokens (Test)
+TELEGRAM_BOT_TOKEN=7903295042:AAGBO2k8pfBDy4RoLRFsknwE7z0N-thAPI8
+ADMINPANEL_TELEGRAM_BOT_TOKEN=8588876086:AAHoZncfhTCbul1BblpvnZMzvz7jAYVFmcw
--- a/.forgejo/workflows/deploy.yml
+++ b/.forgejo/workflows/deploy.yml
@ -0,0 +1,52 @@
+name: CI/CD Pipeline
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  build-and-deploy:
+    runs-on: shell
+    steps:
+      - name: Clone repository
+        run: git clone --depth 1 "http://192.168.8.174:3000/${GITHUB_REPOSITORY}.git" .
+        env:
+          GIT_TERMINAL_PROMPT: '0'
+
+      - name: Ensure Docker CLI
+        run: |
+          apk add --no-cache docker-cli docker-cli-compose openssh-client || true
+          grep -q '^vrubel:' /etc/passwd || echo 'vrubel:x:1000:1000::/data:/bin/sh' >> /etc/passwd
+
+      - name: Setup .env for CI/CD
+        run: cp .env.example .env
+
+      - name: Build Docker images
+        run: docker-compose build
+
+      - name: Login to Gitea Container Registry
+        run: echo "${{ secrets.REGISTRY_TOKEN }}" | docker login http://192.168.8.174:3000 -u "${{ secrets.REGISTRY_USER }}" --password-stdin
+
+      - name: Push images to registry
+        run: |
+          docker push 192.168.8.174:3000/vrubel/lichess-api:latest
+          docker push 192.168.8.174:3000/vrubel/lichess-bot:latest
+          docker push 192.168.8.174:3000/vrubel/lichess-admin:latest
+          docker push 192.168.8.174:3000/vrubel/lichess-web:latest
+
+      - name: Transfer images to prod
+        run: |
+          docker save \
+            192.168.8.174:3000/vrubel/lichess-api:latest \
+            192.168.8.174:3000/vrubel/lichess-bot:latest \
+            192.168.8.174:3000/vrubel/lichess-admin:latest \
+            192.168.8.174:3000/vrubel/lichess-web:latest \
+          | ssh -i /data/.ssh/id_ed25519 -o StrictHostKeyChecking=no root@130.17.6.76 docker load
+
+      - name: Deploy on prod host
+        run: |
+          cat docker-compose.prod.yml | ssh -i /data/.ssh/id_ed25519 -o StrictHostKeyChecking=no root@130.17.6.76 \
+            "cat > ~/services/LichessStatTgWeb/docker-compose.yml"
+          ssh -i /data/.ssh/id_ed25519 -o StrictHostKeyChecking=no root@130.17.6.76 \
+            "cd ~/services/LichessStatTgWeb && docker compose up -d --remove-orphans"
--- a/.gitignore
+++ b/.gitignore
@ -40,7 +40,7 @@ logs/
 .dockerignore

 # Environment
-# .env - НЕ в ignore, чтобы параметры проекта были в репозитории
+.env
 .env.local
 .env.backup

--- a/LichessClientTG_bot/config.py
+++ b/LichessClientTG_bot/config.py
@ -3,25 +3,8 @@ from dotenv import load_dotenv

 load_dotenv()

-IS_PROD = True
-
-# Telegram Bot Configuration (Production)
-TELEGRAM_BOT_TOKEN_PROD = "8241474807:AAH684LTY93aXRou4-LtqU5-p8LuEjzYn8U"
-# Admin Panel Bot Configuration (Production)
-ADMINPANEL_TELEGRAM_BOT_TOKEN_PROD = "7918349610:AAEZH7lbzdams31rCDZXeaAzFluDWfUQoLg"
-
-# Telegram Bot Configuration (Test)
-TELEGRAM_BOT_TOKEN_TEST = "7903295042:AAGBO2k8pfBDy4RoLRFsknwE7z0N-thAPI8"
-# Admin Panel Bot Configuration (Test)
-ADMINPANEL_TELEGRAM_BOT_TOKEN_TEST = "8588876086:AAHoZncfhTCbul1BblpvnZMzvz7jAYVFmcw"
-
-# Select tokens based on IS_PROD flag
-if IS_PROD:
-    TELEGRAM_BOT_TOKEN = TELEGRAM_BOT_TOKEN_PROD
-    ADMINPANEL_TELEGRAM_BOT_TOKEN = ADMINPANEL_TELEGRAM_BOT_TOKEN_PROD
-else:
-    TELEGRAM_BOT_TOKEN = TELEGRAM_BOT_TOKEN_TEST
-    ADMINPANEL_TELEGRAM_BOT_TOKEN = ADMINPANEL_TELEGRAM_BOT_TOKEN_TEST
+TELEGRAM_BOT_TOKEN = os.getenv("TELEGRAM_BOT_TOKEN")
+ADMINPANEL_TELEGRAM_BOT_TOKEN = os.getenv("ADMINPANEL_TELEGRAM_BOT_TOKEN")


 # Lichess API Configuration
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@ -0,0 +1,66 @@
+services:
+  lichess-api:
+    image: 192.168.8.174:3000/vrubel/lichess-api:latest
+    container_name: lichess-api
+    ports:
+      - "8002:8000"
+    environment:
+      - PYTHONUNBUFFERED=1
+    restart: always
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health').read()"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+  lichess-bot:
+    image: 192.168.8.174:3000/vrubel/lichess-bot:latest
+    container_name: lichess-telegram-bot
+    volumes:
+      - ./data:/app/data
+    env_file:
+      - .env
+    environment:
+      - PYTHONPATH=/app
+      - PYTHONUNBUFFERED=1
+    network_mode: "host"
+    restart: always
+    depends_on:
+      - lichess-api
+    healthcheck:
+      test: ["CMD", "python", "-c", "import requests; requests.get('http://localhost:8002/health', timeout=5)"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+
+  admin-bot:
+    image: 192.168.8.174:3000/vrubel/lichess-admin:latest
+    container_name: lichess-admin-bot
+    volumes:
+      - ./data:/app/data
+    env_file:
+      - .env
+    environment:
+      - PYTHONPATH=/app
+      - PYTHONUNBUFFERED=1
+    network_mode: "host"
+    restart: always
+    depends_on:
+      - lichess-api
+
+  web-view:
+    image: 192.168.8.174:3000/vrubel/lichess-web:latest
+    container_name: lichess-web-view
+    ports:
+      - "5000:5000"
+    volumes:
+      - ./data:/app/data:ro
+    restart: always
+    depends_on:
+      - lichess-bot
+
+networks:
+  default:
+    name: lichess-network
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -2,6 +2,7 @@ services:
  # Lichess Web Services (API)
  lichess-api:
    build: ./LichessWebServices
+    image: 192.168.8.174:3000/vrubel/lichess-api:latest
    container_name: lichess-api
    ports:
      - "8002:8000"
@ -20,10 +21,13 @@ services:
  # Telegram Bot
  lichess-bot:
    build: ./LichessClientTG_bot
+    image: 192.168.8.174:3000/vrubel/lichess-bot:latest
    container_name: lichess-telegram-bot
    volumes:
      - ./LichessClientTG_bot/data:/app/data
      - ./LichessClientTG_bot:/app
+    env_file:
+      - .env
    environment:
      - PYTHONPATH=/app
      - PYTHONUNBUFFERED=1
@ -43,10 +47,13 @@ services:
    build:
      context: ./LichessClientTG_bot
      dockerfile: Dockerfile.admin
+    image: 192.168.8.174:3000/vrubel/lichess-admin:latest
    container_name: lichess-admin-bot
    volumes:
      - ./LichessClientTG_bot/data:/app/data
      - ./LichessClientTG_bot:/app
+    env_file:
+      - .env
    environment:
      - PYTHONPATH=/app
      - PYTHONUNBUFFERED=1
@ -58,6 +65,7 @@ services:
  # Web View Interface
  web-view:
    build: ./LichessWebView
+    image: 192.168.8.174:3000/vrubel/lichess-web:latest
    container_name: lichess-web-view
    ports:
      - "5000:5000"
Author	SHA1	Message	Date
vrubelroman	1fe8deb0de	ci: add Forgejo CI/CD pipeline with docker save/load deploy to prod All checks were successful CI/CD Pipeline / build-and-deploy (push) Successful in 1m24s Details Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-30 18:55:21 +00:00
vrubelroman	8828375207	refactor: move bot tokens to .env, remove hardcoded credentials - Remove IS_PROD flag and hardcoded tokens from config.py - Read TELEGRAM_BOT_TOKEN and ADMINPANEL_TELEGRAM_BOT_TOKEN from env - Add env_file: .env to lichess-bot and admin-bot in docker-compose.yml - Add .env to .gitignore (no longer tracked) - Add .env.example with test tokens	2026-06-30 18:15:44 +00:00